Single Event Not Parsed Correctly

Elastic Stack Beats
5

This is the entirety of it:

`filebeat.prospectors:`

# Each - is a prospector. Most options can be set at the prospector level, so
# you can use different prospectors for various configurations.
# Below are the prospector specific configurations.

- input_type: log

  # Paths that should be crawled and fetched. Glob based paths.
  paths:
    - /var/log/mylog.log
  multiline.pattern: '^{'
  multiline.negate: true
  multiline.match:  after

When the log file is written (script pulls info from API every 5 mins and writes it), first it is written to a tmp file (in /tmp). After the log file is finished being written, it is moved to /var/log/mylog.log (copied over existing file, replacing it).

The log event will get clipped, like:

pproved",
  "eventtype": "authentication",
  "location": {
      "city": "Shytown",
      "state": "GA",
      "country": "US"
  },
  "factor": "Duo Push",
  "device": "111-111-1111",
  "result": "SUCCESS"
}

When it should be like:

{
    "username": "udaman",
    "access_device": {
        "flash_version": "uninstalled",
        "java_version": "uninstalled",
        "os_version": "7",
        "browser_version": "63.0.3239.132",
        "os": "Windows",
        "browser": "Chrome"
    },
    "timestamp": 1517263774,
    "new_enrollment": false,
    "ip": "111.111.111.111.",
    "integration": "My Integration", 
    "host": "api.duosecurity.com",
    "reason": "User approved",
    "eventtype": "authentication",
    "location": {
        "city": "Shytown",
        "state": "GA",
        "country": "US"
    },
    "factor": "Duo Push",
    "device": "111-111-1111",
    "result": "SUCCESS"
}

Does this help to clarify?

Furthermore, the log file is written like this, one event after the other:

{
    "username": "udaman",
    "access_device": {
        "flash_version": "uninstalled",
        "java_version": "uninstalled",
        "os_version": "7",
        "browser_version": "63.0.3239.132",
        "os": "Windows",
        "browser": "Chrome"
    },
    "timestamp": 1517263774,
    "new_enrollment": false,
    "ip": "111.111.111.111.",
    "integration": "My Integration", 
    "host": "api.duosecurity.com",
    "reason": "User approved",
    "eventtype": "authentication",
    "location": {
        "city": "Shytown",
        "state": "GA",
        "country": "US"
    },
    "factor": "Duo Push",
    "device": "111-111-1111",
    "result": "SUCCESS"
}
{
    "username": "udaman",
    "access_device": {
        "flash_version": "uninstalled",
        "java_version": "uninstalled",
        "os_version": "7",
        "browser_version": "63.0.3239.132",
        "os": "Windows",
        "browser": "Chrome"
    },
    "timestamp": 1517263774,
    "new_enrollment": false,
    "ip": "111.111.111.111.",
    "integration": "My Integration", 
    "host": "api.duosecurity.com",
    "reason": "User approved",
    "eventtype": "authentication",
    "location": {
        "city": "Shytown",
        "state": "GA",
        "country": "US"
    },
    "factor": "Duo Push",
    "device": "111-111-1111",
    "result": "SUCCESS"
}

Thanks,
Cappy